How we build

Why we show the working, including where it is guessed

One chart on every report is synthesised rather than measured. Saying so costs credibility in the short term and is the only way to keep it.

There is a chart on every LegitSonar report that is not a measurement. It is generated. We put a note on the methodology page saying so, which is a strange thing to advertise, and this is why we did it anyway.

The chart in question

Each report shows fifteen months of trust history — a line arriving at today's score. It looks like a record of past assessments. It is not one. The underlying data captured a single moment in time; the line before that moment is derived from the current score by a deterministic walk. It is stable, it always lands on the real value, and every point before the last is invented.

The same applies, more mildly, to the dates on individual findings. The findings are real. Their individual timestamps are spread around the analysis date because it reads better, not because each one was separately observed.

Why it exists at all

Honestly: because the design called for a trend line and there was no trend to draw. That is a perfectly ordinary situation, and there were three ways out of it.

Ship without the chart. Ship the chart and say nothing. Or ship the chart and label it. The first loses something that will be true in a year, once enough re-scans have accumulated to draw a real line. The second is the one almost everybody picks.

Why the second option is worse than it looks

A trust score is a claim about someone else's honesty. It is difficult to see how you make that claim credibly from behind an undisclosed embellishment, however small and however cosmetic.

The practical argument is the same. Anyone who scans the same domain twice and compares the two charts would work it out in an afternoon. Discovering it that way is far more damaging than reading it on the methodology page — at that point the question stops being "is this chart real" and becomes "what else".

Where the line is

Deriving something and labelling it is fine. Deriving something and presenting it as measured is not. That is the whole rule, and it is why the methodology page has a section headed "What is derived, not measured" rather than a footnote.

The same instinct shows up elsewhere on the site. The browser extension page says the extension does not exist. The pricing page says the paid tiers are not built. The legal notice says the host details are missing rather than filling them with something plausible. None of that is comfortable to write, and all of it is cheaper than being found out.

What replaces it

Every live scan now records a real assessment with a real timestamp. Once a domain has been scanned more than once, there is a genuine history to draw — and when there is enough of it, the generated line goes and this article gets an update rather than a quiet deletion.

Keep reading

More from the blog

Check a domain while it is fresh in your mind

Everything described here is what the scanner looks at. Point it at something and see the reasoning for yourself.

Analyse a domain